# M12-02F Status

status: done
task: quarantine corrupt preview content while keeping asset metadata readable
updated: 2026-08-17 America/New_York
enablingTask: true
parityStateChange: false

## Scope

The preview inspector validates payload byte length and SHA-256 independently from the catalog.
Healthy bytes return `READY`. Missing or mismatched bytes return a structured
`ASSET_SOURCE_HASH_MISMATCH` quarantine receipt; present corrupt bytes are copied, verified, and
then removed from the content-addressed namespace before the receipt is published.

The catalog row and its preview provenance are not rewritten on corruption. Consumers receive the
complete parsed asset metadata together with `preview=null/data=null`, so a broken optional image
cannot make the asset name, type, catalog, license, tags, or source metadata unreadable. A matching
quarantine receipt is stable across database reopen.

## Evidence

- `WEB_TEST_PORT=5598 npm --prefix web run test:asset-preview-quarantine` passed the artifact unit
  test 1/1 and real Chromium OPFS/IndexedDB test 1/1.
- The checked-in 513-byte PNG first returned `READY`; same-length byte tampering then returned
  `QUARANTINED` with a different actual SHA-256 and stable error code.
- The corrupt file was absent from the SHA-256 namespace and present as a verified 513-byte file in
  the quarantine directory. Database reopen returned the exact same receipt without reading it.
- Catalog revision 8, the target asset metadata/reference, and the unrelated asset all remained
  exactly unchanged.

## Artifact Hashes

- quarantine protocol: `a5f3330dbd16d9f578d85d9504c980fffea85b834b77340a307ce21ce9b1cb04`
- Chromium suite: `d8e1d0741765e8f8bfd47b45cf03213d8629efdbbf77dfd33846785a3ec80c27`
- unit suite: `79c836c7a3be4e9f305a962775444c766577cca87fa6d1698811e75eb21f2d9a`
- manifest: `d1a9feeb98c5332b1a14a14c5b813d75a29f172601590e1b5cde254c5059a7c5`
- package commands: `77b5cd3d3af68ac390d8fbdb9b2f64764fb4521a1d2bf22cd8a89e40d69424f6`

## Next Task

`M12-02G`: reclaim a preview payload only after its final project-scoped reference is removed,
without touching another project's copy.

## Rollback

Remove the quarantine protocol, Chromium/unit suites, M12-02F manifest, package command, and this
status entry. Restore M12-02F to pending and `nextTask` to M12-02F. Catalog and parity ledger data
do not require rollback.